Generate JWKS from X.509 Certificate

I already hold an X.509 digital certificate and I now need a matching set of JSON Web Key Sets (JWKS) built from it so I can feed the keys into an OAuth / OIDC gateway. The keys must be created for the RSA algorithm only; I do not require EC or HMAC variants at this stage.

What I will hand over:
• The existing X.509 certificate file (public and private parts available) along with any password that protects the private key.
• Any metadata you need about issuer, key-use (sig), kid naming conventions, or expiry.

What I expect back:
• A correctly structured jwks.json containing the public RSA key entries ready for direct publication.
• The corresponding private key in a secure format of my choosing (PKCS#12 or PEM) and clear instructions on how it maps to the JWKS.
• A short, repeatable script or command sequence (OpenSSL, jose-utils, or another widely available tool) so I can regenerate the JWKS myself whenever the certificate rotates.
• Verification notes showing that the produced JWKS validates a sample JWT signature.

Acceptance criteria
1. Keys load without warnings in common libraries (e.g., Node-jose, Nimbus JOSE + JWT).
2. The RSA modulus and exponent in the JWKS match those derived directly from the certificate.
3. Your regeneration script runs on a standard Linux shell with no proprietary dependencies.

If you have prior experience turning X.509 material into JWKS, especially for RSA, I would love to work with you.